{"record":{"id":"efcffc2ea4ed3c33","repo":"langflow-ai/langflow","slug":"flow-not-found-efcffc","errorCode":null,"errorMessage":"Flow not found","messagePattern":"Flow not found","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"src/backend/base/langflow/api/v1/files.py","lineNumber":79,"sourceCode":"        logger.exception(\"Exception occurred while getting allowed profile picture folders\")\n\n    # Sensible defaults ensure tests and OOTB behavior\n    return allowed or {\"People\", \"Space\"}\n\n\n# Create dep that gets the flow_id from the request\n# then finds it in the database and returns it while\n# using the current user as the owner\nasync def get_flow(\n    flow_id: UUID,\n    current_user: CurrentActiveUser,\n    session: DbSession,\n):\n    # AttributeError: 'SelectOfScalar' object has no attribute 'first'\n    flow = await session.get(Flow, flow_id)\n    # Return 404 for both non-existent flows and unauthorized access to prevent information disclosure\n    if not flow or flow.user_id != current_user.id:\n        raise HTTPException(status_code=404, detail=\"Flow not found\")\n    return flow\n\n\n@router.post(\"/upload/{flow_id}\", status_code=HTTPStatus.CREATED)\nasync def upload_file(\n    *,\n    file: UploadFile,\n    flow: Annotated[Flow, Depends(get_flow)],\n    current_user: CurrentActiveUser,\n    storage_service: Annotated[StorageService, Depends(get_storage_service)],\n    settings_service: Annotated[SettingsService, Depends(get_settings_service)],\n) -> UploadFileResponse:\n    # Writing a file to a flow's storage is a flow mutation: enforce WRITE so\n    # the external access ceiling (e.g. a \"viewer\") cannot upload via this route.\n    await ensure_flow_permission(\n        current_user,\n        FlowAction.WRITE,\n        flow_id=flow.id,","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/files.py#L61-L97","documentation":"The get_flow dependency for the files API returns 404 'Flow not found' when session.get(Flow, flow_id) returns nothing OR when the flow exists but belongs to a different user. The single message for both cases is deliberate: it prevents information disclosure about which flow IDs exist. Any files route hit with a foreign/nonexistent flow_id (upload, download, images) fails here before the handler runs.","triggerScenarios":"POST /api/v1/files/upload/{flow_id} with a mistyped or deleted flow_id; GET /files/download/{flow_id}/{file} where the authenticated user is not the flow owner; using credentials of a different user than the one who created the flow.","commonSituations":"Session/token switched between creating the flow and uploading the file; flow deleted by another admin; copy-pasting a download URL between accounts; stale flow_id cached in frontend after a re-import.","solutions":["Verify the flow_id exists and is owned by the current user: GET /api/v1/flows/{flow_id} as the same credentials","Re-authenticate as the user who owns the flow, or have the flow shared/transferred to you","If the flow was deleted, recreate it and re-upload files against the new flow_id","Check you are not pointing at another workspace's flow (multi-user instance)"],"exampleFix":"// before\nawait api.post(`/files/upload/${oldFlowId}`, formData); // 404\n\n// after\nconst flow = await api.get(`/flows/${flowId}`); // confirm 200 first\nawait api.post(`/files/upload/${flow.data.id}`, formData);","handlingStrategy":"validation","validationCode":"def flow_accessible(client, flow_id: str) -> bool:\n    resp = client.get(f\"/api/v1/flows/{flow_id}\")\n    return resp.status_code == 200","typeGuard":"import uuid\n\ndef is_valid_flow_id(flow_id: str) -> bool:\n    try:\n        uuid.UUID(flow_id)\n        return True\n    except ValueError:\n        return False","tryCatchPattern":"try:\n    client.get(f\"/api/v1/files/download/{flow_id}/{name}\").raise_for_status()\nexcept HTTPError as e:\n    if e.response.status_code == 404:\n        refresh_flow_list()  # flow deleted or not owned by this user\n    raise","preventionTips":["Always source flow_id from the create/list flows response, never hand-typed","Re-check flow access before batch file operations","Treat 404 as both missing and unauthorized — don't leak which"],"tags":["files","http-404","authorization","flow-id"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}